docs(amendment): 2c-E — TradeIntent under the exact-output market model

[cryptskii]

Why this exists

5c-2 Step 1 listed four documents to be reviewed before code. Three landed inside 2c-A.1 and 2c-B. The fourth — the canonical TradeIntent commitment I, and what "the selected route satisfies I" means to a verifier — never did. Amendment 2c already recorded that it was left as prose. It is still prose. This replaces it.

The mismatch

Found while checking whether the 5c-2 producer could actually be written.

MarketTerms field 1 carries a complete nine-field TradeIntent. RouteCommit is pinned at version 2 and carries no min_out, max_fee, max_fanout or k. That absence is deliberate — v1's slippage floors and pre-signed fallbacks were deleted for "one route, one anchored state, one exact output, one signature", with fields 11 and 12 reserved.

A fifth member, max_hops, is derivable only by inverting the authority direction the registry states: Route validity reads its bound out of the intent, so deriving the bound from the route is not a derivation.

So the producer could not build a faithful intent, and inventing the absent members would hash invented values into I — a canonical commitment no verifier could re-derive.

The ruling

Taken before any code was written: amend the object to the shipped model. Do not invent the fields, do not derive them from the already-selected route, and do not restore them to RouteCommit to preserve an obsolete schema. Write the amendment first.

Schema 2

Six fields, each reconciled against the canonical RouteCommit the trader signs with its signature zeroed: token_in, amount_in, token_out, exact_out, fee_bps, nonce. Schema 1 is burned.

Every dropped member is accounted for rather than dropped:

dropped	what protects it now
min_out	there is no floor; exact_out is exact and must be reproduced exactly
max_fee	the rate is exact, and the vault's own fee policy is the authority the settle is checked against
max_hops	exact correspondence with the signed RouteCommit hops — stronger, and against a signed fact
max_fanout	no wire source; beta emits one
k	per the ruling, not trader intent material merely because binding later uses it

The clause that matters

§6 states the satisfaction predicate in six clauses. SAT.5 is the one carrying the weight: exact_out is checked by re-simulating the market policy against the authenticated vault state that c_n names, never against the route's own account of itself.

Without that, the predicate would be a self-attestation of the selected route, which is precisely the failure the ruling names.

Transitive cascade

Mechanical, not a judgement call, per the registry's own propagation rule:

0x000B TradeIntent  1→2 ───► 0x0033 MarketTerms       1→2
                              └───► 0x000E SettlementBundle 1→2

All three are at schema 1 today, verified in source. Every market bundle's identity and address move. The close arm changes no substance but shares the enclosing class.

Nothing is broken

There is no production producer of TradeIntent or of the canonical MarketTerms anywhere in the tree — every construction is a fixture or the decoder. Something that was never constructible is being made constructible.

Scope

TA_B and the bundle-acceptance leaf remain 2c-D's. Market realization stays unreachable until 2c-D by Ruling V3. RouteCommit is not amended — its exact-output model is what is being conformed to.

This does not lift the market emission refusal. It removes the reason the producer that lifts it could not be written.

§8 lists what the adopting change owes, including that the market class-1 vector is regenerated exactly once, from the genuine producer, and never before it exists.

Verification

Markdown only. Neither make lint nor ci/production_safety_checks.sh reads markdown, so neither gate's result can change; CI runs both regardless. Every factual claim — the three current schema numbers, the absent wire fields, the fee authority check, the unencoded route-set class, and the absence of any production producer — was read from source rather than assumed.